Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 6 Jun 2009 20:00:20 +0400
From: Eygene Ryabinkin <>
	"Steven M. Christey" <>
Subject: Re: CVE request: "billion laughs" attack against
	Apache APR

Good day.

Wed, Jun 03, 2009 at 04:07:43PM +0100, Joe Orton wrote:
> The expat XML parser is vulnerable to the "billion laughs" entity 
> expansion attack.  This results in a denial of service vulnerability in 
> any network-facing service which uses the Apache "APR-util" library's 
> wrapper interface for expat to parse untrusted XML documents.  The 
> Apache httpd WebDAV module "mod_dav" is such a service.
> References: 
> Affected versions: 
> APR-util <= 1.3.4

Fri, Jun 05, 2009 at 08:21:16PM -0400, Josh Bressers wrote:
> So there's another apr-util flaw. The initial mail makes it sound pretty
> scary, but it's really not that bad.
> You can find all the scary details here:

Please, note that these two issues and CVE-2009-0023 seem to be
applicable to Apache 2.2.11 and Apache 2.0.63 (latest 2.x versions),
since they have bundled apr-util inside.  At least both have the
vulnerable code and I had verified the "billion laughs" attack against
Apache 2.2.11 with Subversion mod_dav_svn that uses internal Apache
libaprutil.  OS for testing was FreeBSD, but I think that others are
affected as well.

CC'ing Apache security contacts in case they aren't informed about this
issue yet.  Folks, may be I am wrong in my assertions?

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.